IVI LABS OOD ("the Company", "we") is a personal data controller under Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act. This Privacy Policy describes how we collect, process, store and protect the personal data of users of the Invexa platform, available at https://invexa.bg.

This Policy applies to all persons interacting with our platform — including registered users, website visitors and counterparties.

Personal data controller:
Name: IVI LABS OOD
UIC: 206802849
Address: 71 Stoycho Moshanov Str., Plovdiv, Republic of Bulgaria
Contact email for personal data matters: support@invexa.bgWebsite: https://invexa.bg

3.1. Data you provide directly
Identification data: full name, personal identification number (EGN/LNCh) (where necessary for invoicing), address
Contact data: email address, phone number
Account data: username, encrypted password, preferences
Financial and business data: data on invoices, clients, suppliers, bank accounts (IBAN), VAT numbers
Payment data: information about payments made (without storing full card details — these are processed by a certified payment provider)

3.2. Data collected automatically
Technical data: IP address, browser type and version, operating system
Usage data: pages visited, features used, frequency and duration of sessions
Cookies and similar technologies (see Cookie Policy)
Logs: date and time of sign-in, IP addresses, actions performed on the platform

3.3. Data from third parties
When integrating with banking institutions under PSD2 — transaction data provided with your explicit consent
When using OAuth authentication (e.g. Google) — public profile and email address

4.1. Performance of a contract (Art. 6(1)(b) GDPR)
Registration and account management
Provision of the platform's features
Payment processing and subscription management
Technical support and communication

4.2. Legal obligation (Art. 6(1)(c) GDPR)
Retention of accounting records in accordance with the Accountancy Act
Compliance with the requirements of the National Revenue Agency (NRA) and tax legislation
Responding to requests from competent authorities

4.3. Legitimate interest (Art. 6(1)(f) GDPR)
Improving security and preventing abuse
Analysis and improvement of the platform's features
Sending system notifications and technical messages

4.4. Consent (Art. 6(1)(a) GDPR)
Sending marketing emails and newsletters
Analytics cookies and behavior tracking
You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal

We retain your personal data only for as long as necessary to achieve the purposes for which it was collected, or for as long as required by law:
Account and invoicing data: 5 years after termination of the account (a requirement of the Accountancy Act)
Security logs: 12 months
Marketing data (where consent has been given): until consent is withdrawn
Cookies: according to the type of cookie (see Cookie Policy)
Backups: up to 30 days after the data is deleted

6.1. Data processors - We transfer personal data only to trusted partners acting as data processors on our behalf, on the basis of data processing agreements concluded with them:

Cloud infrastructure providers (hosting, databases)
Payment processors (PCI-DSS certified)
Email communication providers
Analytics services (with your consent)

6.2. Transfers outside the EU/EEA - When transferring data to third countries outside the EU/EEA, we apply appropriate safeguards — standard contractual clauses (SCCs) or adequacy decisions of the European Commission. The specific recipients outside the EU are disclosed upon request at support@invexa.bg.

6.3. Disclosure required by law - We may disclose data to competent authorities (courts, the prosecution service, the NRA, the Commission for Personal Data Protection (CPDP)) where there is a legal obligation or a justified request.

Under GDPR, you have the following rights, which you may exercise by email to support@invexa.bg:
Right of access (Art. 15 GDPR): to obtain a copy of your data being processed
Right to rectification (Art. 16 GDPR): to request the correction of inaccurate or incomplete data
Right to erasure (Art. 17 GDPR): "the right to be forgotten" — where there are grounds for it
Right to restriction of processing (Art. 18 GDPR)Right to data portability (Art. 20 GDPR): to receive your data in a structured, machine-readable format
Right to object (Art. 21 GDPR): to processing based on legitimate interest or for direct marketing purposes
Right to withdraw consent: at any time, without affecting the lawfulness of prior processing

We respond to your requests within 30 days. Where a request is complex, this period may be extended by up to 2 months, in which case we will notify you.

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): www.cpdp.bg | tel.: 02/91-53-518.

We apply appropriate technical and organizational measures to protect personal data:
Encryption of data in transit (TLS/SSL) and at rest (AES-256)
Regular security audits and penetration tests
Access control based on the principle of least privilege
Incident response procedures and notification of the CPDP within 72 hours
Regular backups with restore testing

We do not carry out automated decision-making that produces legal effects concerning you, including profiling within the meaning of Art. 22 GDPR. The AI features of Invexa serve solely as a tool to support your business decisions — the final decision always remains with you.